@budibase/server 2.7.18 → 2.7.20-alpha.0

package/dist/query.js

@@ -838,6 +838,7 @@ var init_automation2 = __esm({
       AutomationIOType2["NUMBER"] = "number";
       AutomationIOType2["ARRAY"] = "array";
       AutomationIOType2["JSON"] = "json";
+      AutomationIOType2["DATE"] = "date";
       return AutomationIOType2;
     })(AutomationIOType || {});
     AutomationCustomIOType = /* @__PURE__ */ ((AutomationCustomIOType2) => {
@@ -10777,7 +10778,7 @@ function lowerBuiltinRoleID(roleId1, roleId2) {
   }
   return builtinRoleToNumber(roleId1) > builtinRoleToNumber(roleId2) ? roleId2 : roleId1;
 }
-async function getRole(roleId) {
+async function getRole(roleId, opts) {
   if (!roleId) {
     return void 0;
   }
@@ -10793,6 +10794,9 @@ async function getRole(roleId) {
     role = Object.assign(role, dbRole);
     role._id = getExternalRoleID(role._id);
   } catch (err) {
+    if (!isBuiltin(roleId) && (opts == null ? void 0 : opts.defaultPublic)) {
+      return cloneDeep2(BUILTIN_ROLES.PUBLIC);
+    }
     if (Object.keys(role).length === 0) {
       throw err;
     }
@@ -11481,8 +11485,8 @@ async function preAuth(passport2, ctx, next) {
     callbackUrl,
     ssoSaveUserNoOp
   );
-  if (!ctx.query.appId || !ctx.query.datasourceId) {
-    ctx.throw(400, "appId and datasourceId query params not present.");
+  if (!ctx.query.appId) {
+    ctx.throw(400, "appId query param not present.");
   }
   return passport2.authenticate(strategy, {
     scope: ["profile", "email", "https://www.googleapis.com/auth/spreadsheets"],
@@ -11502,7 +11506,7 @@ async function postAuth(passport2, ctx, next) {
         clientSecret: config.clientSecret,
         callbackURL: callbackUrl
       },
-      (accessToken, refreshToken, profile, done) => {
+      (accessToken, refreshToken, _profile, done) => {
         clearCookie(ctx, "budibase:datasourceauth" /* DatasourceAuth */);
         done(null, { accessToken, refreshToken });
       }
@@ -11510,22 +11514,14 @@ async function postAuth(passport2, ctx, next) {
     { successRedirect: "/", failureRedirect: "/error" },
     async (err, tokens) => {
       const baseUrl = `/builder/app/${authStateCookie.appId}/data`;
-      await doWithDB(authStateCookie.appId, async (db2) => {
-        let datasource2;
-        try {
-          datasource2 = await db2.get(authStateCookie.datasourceId);
-        } catch (err2) {
-          if (err2.status === 404) {
-            ctx.redirect(baseUrl);
-          }
-        }
-        if (!datasource2.config) {
-          datasource2.config = {};
+      const id = newid();
+      await store(
+        `datasource:creation:${authStateCookie.appId}:google:${id}`,
+        {
+          tokens
         }
-        datasource2.config.auth = { type: "google", ...tokens };
-        await db2.put(datasource2);
-        ctx.redirect(`${baseUrl}/datasource/${authStateCookie.datasourceId}`);
-      });
+      );
+      ctx.redirect(`${baseUrl}/new?continue_google_setup=${id}`);
     }
   )(ctx, next);
 }
@@ -11575,16 +11571,22 @@ var encryption_exports = {};
 __export(encryption_exports, {
   SecretOption: () => SecretOption,
   decrypt: () => decrypt,
+  decryptFile: () => decryptFile,
   encrypt: () => encrypt,
+  encryptFile: () => encryptFile,
   getSecret: () => getSecret
 });
 var import_crypto = __toESM(require("crypto"));
+var import_fs2 = __toESM(require("fs"));
+var import_zlib = __toESM(require("zlib"));
 init_environment2();
+var import_path2 = require("path");
 var ALGO = "aes-256-ctr";
 var SEPARATOR3 = "-";
 var ITERATIONS = 1e4;
-var RANDOM_BYTES = 16;
 var STRETCH_LENGTH = 32;
+var SALT_LENGTH = 16;
+var IV_LENGTH = 16;
 var SecretOption = /* @__PURE__ */ ((SecretOption2) => {
   SecretOption2["API"] = "api";
   SecretOption2["ENCRYPTION"] = "encryption";
@@ -11608,11 +11610,11 @@ function getSecret(secretOption) {
   }
   return secret;
 }
-function stretchString(string, salt) {
-  return import_crypto.default.pbkdf2Sync(string, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
+function stretchString(secret, salt) {
+  return import_crypto.default.pbkdf2Sync(secret, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
 }
 function encrypt(input, secretOption = "api" /* API */) {
-  const salt = import_crypto.default.randomBytes(RANDOM_BYTES);
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
   const stretched = stretchString(getSecret(secretOption), salt);
   const cipher = import_crypto.default.createCipheriv(ALGO, stretched, salt);
   const base = cipher.update(input);
@@ -11629,6 +11631,87 @@ function decrypt(input, secretOption = "api" /* API */) {
   const final = decipher.final();
   return Buffer.concat([base, final]).toString();
 }
+async function encryptFile({ dir, filename }, secret) {
+  const outputFileName = `${filename}.enc`;
+  const filePath = (0, import_path2.join)(dir, filename);
+  const inputFile = import_fs2.default.createReadStream(filePath);
+  const outputFile = import_fs2.default.createWriteStream((0, import_path2.join)(dir, outputFileName));
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
+  const iv = import_crypto.default.randomBytes(IV_LENGTH);
+  const stretched = stretchString(secret, salt);
+  const cipher = import_crypto.default.createCipheriv(ALGO, stretched, iv);
+  outputFile.write(salt);
+  outputFile.write(iv);
+  inputFile.pipe(import_zlib.default.createGzip()).pipe(cipher).pipe(outputFile);
+  return new Promise((r) => {
+    outputFile.on("finish", () => {
+      r({
+        filename: outputFileName,
+        dir
+      });
+    });
+  });
+}
+async function getSaltAndIV(path2) {
+  const fileStream = import_fs2.default.createReadStream(path2);
+  const salt = await readBytes(fileStream, SALT_LENGTH);
+  const iv = await readBytes(fileStream, IV_LENGTH);
+  fileStream.close();
+  return { salt, iv };
+}
+async function decryptFile(inputPath, outputPath, secret) {
+  const { salt, iv } = await getSaltAndIV(inputPath);
+  const inputFile = import_fs2.default.createReadStream(inputPath, {
+    start: SALT_LENGTH + IV_LENGTH
+  });
+  const outputFile = import_fs2.default.createWriteStream(outputPath);
+  const stretched = stretchString(secret, salt);
+  const decipher = import_crypto.default.createDecipheriv(ALGO, stretched, iv);
+  const unzip = import_zlib.default.createGunzip();
+  inputFile.pipe(decipher).pipe(unzip).pipe(outputFile);
+  return new Promise((res, rej) => {
+    outputFile.on("finish", () => {
+      outputFile.close();
+      res();
+    });
+    inputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    decipher.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    unzip.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    outputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+  });
+}
+function readBytes(stream3, length) {
+  return new Promise((resolve3, reject) => {
+    let bytesRead = 0;
+    const data = [];
+    stream3.on("readable", () => {
+      let chunk;
+      while ((chunk = stream3.read(length - bytesRead)) !== null) {
+        data.push(chunk);
+        bytesRead += chunk.length;
+      }
+      resolve3(Buffer.concat(data));
+    });
+    stream3.on("end", () => {
+      reject(new Error("Insufficient data in the stream."));
+    });
+    stream3.on("error", (error) => {
+      reject(error);
+    });
+  });
+}
 
 // ../backend-core/src/middleware/authenticated.ts
 init_identity();
@@ -12386,16 +12469,16 @@ var import_aws_sdk = __toESM(require("aws-sdk"));
 var import_stream = __toESM(require("stream"));
 var import_node_fetch6 = __toESM(require("node-fetch"));
 var import_tar_fs = __toESM(require("tar-fs"));
-var import_zlib = __toESM(require("zlib"));
+var import_zlib2 = __toESM(require("zlib"));
 var import_util = require("util");
-var import_path3 = require("path");
-var import_fs3 = __toESM(require("fs"));
+var import_path4 = require("path");
+var import_fs4 = __toESM(require("fs"));
 init_environment2();
 
 // ../backend-core/src/objectStore/utils.ts
-var import_path2 = require("path");
+var import_path3 = require("path");
 var import_os = require("os");
-var import_fs2 = __toESM(require("fs"));
+var import_fs3 = __toESM(require("fs"));
 init_environment2();
 var ObjectStoreBuckets = {
   BACKUPS: environment_default2.BACKUPS_BUCKET_NAME,
@@ -12404,9 +12487,9 @@ var ObjectStoreBuckets = {
   GLOBAL: environment_default2.GLOBAL_BUCKET_NAME,
   PLUGINS: environment_default2.PLUGIN_BUCKET_NAME
 };
-var bbTmp = (0, import_path2.join)((0, import_os.tmpdir)(), ".budibase");
-if (!import_fs2.default.existsSync(bbTmp)) {
-  import_fs2.default.mkdirSync(bbTmp);
+var bbTmp = (0, import_path3.join)((0, import_os.tmpdir)(), ".budibase");
+if (!import_fs3.default.existsSync(bbTmp)) {
+  import_fs3.default.mkdirSync(bbTmp);
 }
 function budibaseTempDir() {
   return bbTmp;
@@ -12494,7 +12577,7 @@ var upload = async ({
   metadata: metadata2
 }) => {
   const extension = filename.split(".").pop();
-  const fileBytes = import_fs3.default.readFileSync(path2);
+  const fileBytes = import_fs4.default.readFileSync(path2);
   const objectStore = ObjectStore(bucketName);
   await makeSureBucketExists(objectStore, bucketName);
   let contentType = type;
@@ -12596,13 +12679,13 @@ var retrieveToTmp = async (bucketName, filepath) => {
   bucketName = sanitizeBucket(bucketName);
   filepath = sanitizeKey(filepath);
   const data = await retrieve(bucketName, filepath);
-  const outputPath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-  import_fs3.default.writeFileSync(outputPath, data);
+  const outputPath = (0, import_path4.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+  import_fs4.default.writeFileSync(outputPath, data);
   return outputPath;
 };
 var retrieveDirectory = async (bucketName, path2) => {
-  let writePath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-  import_fs3.default.mkdirSync(writePath);
+  let writePath = (0, import_path4.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+  import_fs4.default.mkdirSync(writePath);
   const objects = await listAllObjects(bucketName, path2);
   let fullObjects = await Promise.all(
     objects.map((obj) => retrieve(bucketName, obj.Key))
@@ -12614,9 +12697,9 @@ var retrieveDirectory = async (bucketName, path2) => {
     const possiblePath = filename.split("/");
     if (possiblePath.length > 1) {
       const dirs = possiblePath.slice(0, possiblePath.length - 1);
-      import_fs3.default.mkdirSync((0, import_path3.join)(writePath, ...dirs), { recursive: true });
+      import_fs4.default.mkdirSync((0, import_path4.join)(writePath, ...dirs), { recursive: true });
     }
-    import_fs3.default.writeFileSync((0, import_path3.join)(writePath, ...possiblePath), data);
+    import_fs4.default.writeFileSync((0, import_path4.join)(writePath, ...possiblePath), data);
   }
   return writePath;
 };
@@ -12670,14 +12753,14 @@ var deleteFolder = async (bucketName, folder) => {
 var uploadDirectory = async (bucketName, localPath, bucketPath2) => {
   bucketName = sanitizeBucket(bucketName);
   let uploads = [];
-  const files2 = import_fs3.default.readdirSync(localPath, { withFileTypes: true });
+  const files2 = import_fs4.default.readdirSync(localPath, { withFileTypes: true });
   for (let file of files2) {
-    const path2 = sanitizeKey((0, import_path3.join)(bucketPath2, file.name));
-    const local = (0, import_path3.join)(localPath, file.name);
+    const path2 = sanitizeKey((0, import_path4.join)(bucketPath2, file.name));
+    const local = (0, import_path4.join)(localPath, file.name);
     if (file.isDirectory()) {
       uploads.push(uploadDirectory(bucketName, local, path2));
     } else {
-      uploads.push(streamUpload(bucketName, path2, import_fs3.default.createReadStream(local)));
+      uploads.push(streamUpload(bucketName, path2, import_fs4.default.createReadStream(local)));
     }
   }
   await Promise.all(uploads);
@@ -12689,7 +12772,7 @@ var downloadTarballDirect = async (url, path2, headers = {}) => {
   if (!response.ok) {
     throw new Error(`unexpected response ${response.statusText}`);
   }
-  await streamPipeline(response.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(path2));
+  await streamPipeline(response.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(path2));
 };
 var downloadTarball = async (url, bucketName, path2) => {
   bucketName = sanitizeBucket(bucketName);
@@ -12698,8 +12781,8 @@ var downloadTarball = async (url, bucketName, path2) => {
   if (!response.ok) {
     throw new Error(`unexpected response ${response.statusText}`);
   }
-  const tmpPath = (0, import_path3.join)(budibaseTempDir(), path2);
-  await streamPipeline(response.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
+  const tmpPath = (0, import_path4.join)(budibaseTempDir(), path2);
+  await streamPipeline(response.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
   if (!environment_default2.isTest() && environment_default2.SELF_HOSTED) {
     await uploadDirectory(bucketName, tmpPath, path2);
   }
@@ -14355,7 +14438,8 @@ var PostgresIntegration = class extends sql_default {
     try {
       await this.openConnection();
       const columnsResponse = await this.client.query(this.COLUMNS_SQL);
-      return columnsResponse.rows.map((row) => row.table_name);
+      const names = columnsResponse.rows.map((row) => row.table_name);
+      return [...new Set(names)];
     } finally {
       await this.closeConnection();
     }
@@ -14968,6 +15052,8 @@ var MongoIntegration = class {
       response.connected = true;
     } catch (e) {
       response.error = e.message;
+    } finally {
+      await this.client.close();
     }
     return response;
   }
@@ -17235,11 +17321,39 @@ var hasFilters = (query) => {
 // ../shared-core/src/utils.ts
 var utils_exports3 = {};
 __export(utils_exports3, {
+  parallelForeach: () => parallelForeach,
   unreachable: () => unreachable
 });
 function unreachable(value, message = `No such case in exhaustive switch: ${value}`) {
   throw new Error(message);
 }
+async function parallelForeach(items, task, maxConcurrency) {
+  const promises = [];
+  let index2 = 0;
+  const processItem = async (item) => {
+    try {
+      await task(item);
+    } finally {
+      processNext();
+    }
+  };
+  const processNext = () => {
+    if (index2 >= items.length) {
+      return;
+    }
+    const item = items[index2];
+    index2++;
+    const promise = processItem(item);
+    promises.push(promise);
+    if (promises.length >= maxConcurrency) {
+      Promise.race(promises).then(processNext);
+    } else {
+      processNext();
+    }
+  };
+  processNext();
+  await Promise.all(promises);
+}
 
 // src/integrations/googlesheets.ts
 var ALLOWED_TYPES = [
@@ -17268,7 +17382,7 @@ var SCHEMA12 = {
   },
   datasource: {
     spreadsheetId: {
-      display: "Google Sheet URL",
+      display: "Spreadsheet URL",
       type: "string" /* STRING */,
       required: true
     }
@@ -17389,6 +17503,7 @@ var GoogleSheetsIntegration = class {
   async connect() {
     var _a;
     try {
+      await setupCreationAuth(this.config);
       let googleConfig = await configs_exports.getGoogleDatasourceConfig();
       if (!googleConfig) {
         throw new HTTPError("Google config not found", 400);
@@ -17439,21 +17554,22 @@ var GoogleSheetsIntegration = class {
     return table;
   }
   async buildSchema(datasourceId, entities) {
-    if (!this.config.auth) {
-      return;
-    }
     await this.connect();
     const sheets = this.client.sheetsByIndex;
     const tables = {};
-    for (let sheet of sheets) {
-      await sheet.getRows();
-      const id = buildExternalTableId(datasourceId, sheet.title);
-      tables[sheet.title] = this.getTableSchema(
-        sheet.title,
-        sheet.headerValues,
-        id
-      );
-    }
+    await utils_exports3.parallelForeach(
+      sheets,
+      async (sheet) => {
+        await sheet.getRows({ limit: 0, offset: 0 });
+        const id = buildExternalTableId(datasourceId, sheet.title);
+        tables[sheet.title] = this.getTableSchema(
+          sheet.title,
+          sheet.headerValues,
+          id
+        );
+      },
+      10
+    );
     const final = finaliseExternalTables(tables, entities);
     this.tables = final.tables;
     this.schemaErrors = final.errors;
@@ -17699,6 +17815,16 @@ var GoogleSheetsIntegration = class {
     }
   }
 };
+async function setupCreationAuth(datasouce) {
+  if (datasouce.continueSetupId) {
+    const appId = context_exports.getAppId();
+    const tokens = await cache_exports.get(
+      `datasource:creation:${appId}:google:${datasouce.continueSetupId}`
+    );
+    datasouce.auth = tokens.tokens;
+    delete datasouce.continueSetupId;
+  }
+}
 var googlesheets_default = {
   schema: SCHEMA12,
   integration: GoogleSheetsIntegration
@@ -18477,24 +18603,24 @@ init_src();
 var budibaseTempDir2 = objectStore_exports2.budibaseTempDir;
 
 // src/utilities/fileSystem/app.ts
-var import_path5 = require("path");
+var import_path6 = require("path");
 
 // src/utilities/fileSystem/filesystem.ts
-var import_fs4 = __toESM(require("fs"));
-var import_path4 = require("path");
+var import_fs5 = __toESM(require("fs"));
+var import_path5 = require("path");
 var import_tar = __toESM(require("tar"));
 var uuid2 = require("uuid/v4");
-var TOP_LEVEL_PATH = environment_default.TOP_LEVEL_PATH || (0, import_path4.resolve)((0, import_path4.join)(__dirname, "..", "..", ".."));
+var TOP_LEVEL_PATH = environment_default.TOP_LEVEL_PATH || (0, import_path5.resolve)((0, import_path5.join)(__dirname, "..", "..", ".."));
 var streamFile = (path2) => {
-  return import_fs4.default.createReadStream(path2);
+  return import_fs5.default.createReadStream(path2);
 };
 var createTempFolder = (item) => {
-  const path2 = (0, import_path4.join)(budibaseTempDir2(), item);
+  const path2 = (0, import_path5.join)(budibaseTempDir2(), item);
   try {
-    if (import_fs4.default.existsSync(path2)) {
-      import_fs4.default.rmSync(path2, { recursive: true, force: true });
+    if (import_fs5.default.existsSync(path2)) {
+      import_fs5.default.rmSync(path2, { recursive: true, force: true });
     }
-    import_fs4.default.mkdirSync(path2);
+    import_fs5.default.mkdirSync(path2);
   } catch (err) {
     throw new Error(`Path cannot be created: ${err.message}`);
   }
@@ -18508,18 +18634,18 @@ var extractTarball = async (fromFilePath, toPath) => {
 };
 
 // src/utilities/fileSystem/app.ts
-var NODE_MODULES_PATH = (0, import_path5.join)(TOP_LEVEL_PATH, "node_modules");
+var NODE_MODULES_PATH = (0, import_path6.join)(TOP_LEVEL_PATH, "node_modules");
 
 // src/utilities/fileSystem/plugin.ts
-var import_fs5 = __toESM(require("fs"));
-var import_path6 = require("path");
-var DATASOURCE_PATH = (0, import_path6.join)(budibaseTempDir2(), "datasource");
-var AUTOMATION_PATH = (0, import_path6.join)(budibaseTempDir2(), "automation");
+var import_fs6 = __toESM(require("fs"));
+var import_path7 = require("path");
+var DATASOURCE_PATH = (0, import_path7.join)(budibaseTempDir2(), "datasource");
+var AUTOMATION_PATH = (0, import_path7.join)(budibaseTempDir2(), "automation");
 var getPluginMetadata = async (path2) => {
   let metadata2 = {};
   try {
-    const pkg2 = import_fs5.default.readFileSync((0, import_path6.join)(path2, "package.json"), "utf8");
-    const schema = import_fs5.default.readFileSync((0, import_path6.join)(path2, "schema.json"), "utf8");
+    const pkg2 = import_fs6.default.readFileSync((0, import_path7.join)(path2, "package.json"), "utf8");
+    const schema = import_fs6.default.readFileSync((0, import_path7.join)(path2, "schema.json"), "utf8");
     metadata2.schema = JSON.parse(schema);
     metadata2.package = JSON.parse(pkg2);
     if (!metadata2.package.name || !metadata2.package.version || !metadata2.package.description) {
@@ -18537,19 +18663,19 @@ var getPluginMetadata = async (path2) => {
 async function getPluginImpl(path2, plugin) {
   var _a;
   const hash3 = (_a = plugin.schema) == null ? void 0 : _a.hash;
-  if (!import_fs5.default.existsSync(path2)) {
-    import_fs5.default.mkdirSync(path2);
+  if (!import_fs6.default.existsSync(path2)) {
+    import_fs6.default.mkdirSync(path2);
   }
-  const filename = (0, import_path6.join)(path2, plugin.name);
+  const filename = (0, import_path7.join)(path2, plugin.name);
   const metadataName = `${filename}.bbmetadata`;
-  if (import_fs5.default.existsSync(filename)) {
-    const currentHash = import_fs5.default.readFileSync(metadataName, "utf8");
+  if (import_fs6.default.existsSync(filename)) {
+    const currentHash = import_fs6.default.readFileSync(metadataName, "utf8");
     if (currentHash === hash3) {
       return require(filename);
     } else {
       console.log(`Updating plugin: ${plugin.name}`);
       delete require.cache[require.resolve(filename)];
-      import_fs5.default.unlinkSync(filename);
+      import_fs6.default.unlinkSync(filename);
     }
   }
   const pluginKey = objectStore_exports2.getPluginJSKey(plugin);
@@ -18557,8 +18683,8 @@ async function getPluginImpl(path2, plugin) {
     objectStore_exports2.ObjectStoreBuckets.PLUGINS,
     pluginKey
   );
-  import_fs5.default.writeFileSync(filename, pluginJs);
-  import_fs5.default.writeFileSync(metadataName, hash3);
+  import_fs6.default.writeFileSync(filename, pluginJs);
+  import_fs6.default.writeFileSync(metadataName, hash3);
   return require(filename);
 }
 var getDatasourcePlugin = async (plugin) => {
@@ -18593,19 +18719,20 @@ var GLOBAL_DB_EXPORT_FILE = "global.txt";
 var STATIC_APP_FILES = ["manifest.json", "budibase-client.js"];
 
 // src/sdk/app/backups/exports.ts
-var import_fs6 = __toESM(require("fs"));
-var import_path7 = require("path");
+var import_fs7 = __toESM(require("fs"));
+var import_path8 = require("path");
+var import_tar2 = __toESM(require("tar"));
 var uuid3 = require("uuid/v4");
-var tar3 = require("tar");
 var MemoryStream = require("memorystream");
 function tarFilesToTmp(tmpDir, files2) {
-  const exportFile = (0, import_path7.join)(budibaseTempDir2(), `${uuid3()}.tar.gz`);
-  tar3.create(
+  const fileName = `${uuid3()}.tar.gz`;
+  const exportFile = (0, import_path8.join)(budibaseTempDir2(), fileName);
+  import_tar2.default.create(
     {
       sync: true,
       gzip: true,
       file: exportFile,
-      recursive: true,
+      noDirRecurse: false,
       cwd: tmpDir
     },
     files2
@@ -18622,7 +18749,7 @@ async function exportDB(dbName, opts = {}) {
   return db_exports.doWithDB(dbName, async (db2) => {
     if (opts == null ? void 0 : opts.exportPath) {
       const path2 = opts == null ? void 0 : opts.exportPath;
-      const writeStream = import_fs6.default.createWriteStream(path2);
+      const writeStream = import_fs7.default.createWriteStream(path2);
       await db2.dump(writeStream, exportOpts);
       return path2;
     } else {
@@ -18655,9 +18782,9 @@ async function exportApp(appId, config) {
       for (let path2 of STATIC_APP_FILES) {
         const contents = await objectStore_exports2.retrieve(
           ObjectStoreBuckets2.APPS,
-          (0, import_path7.join)(appPath, path2)
+          (0, import_path8.join)(appPath, path2)
         );
-        import_fs6.default.writeFileSync((0, import_path7.join)(tmpPath, path2), contents);
+        import_fs7.default.writeFileSync((0, import_path8.join)(tmpPath, path2), contents);
       }
     } else {
       tmpPath = await objectStore_exports2.retrieveDirectory(
@@ -18666,33 +18793,48 @@ async function exportApp(appId, config) {
       );
     }
   }
-  const downloadedPath = (0, import_path7.join)(tmpPath, appPath);
-  if (import_fs6.default.existsSync(downloadedPath)) {
-    const allFiles = import_fs6.default.readdirSync(downloadedPath);
+  const downloadedPath = (0, import_path8.join)(tmpPath, appPath);
+  if (import_fs7.default.existsSync(downloadedPath)) {
+    const allFiles = import_fs7.default.readdirSync(downloadedPath);
     for (let file of allFiles) {
-      const path2 = (0, import_path7.join)(downloadedPath, file);
-      import_fs6.default.renameSync(path2, (0, import_path7.join)(downloadedPath, "..", file));
+      const path2 = (0, import_path8.join)(downloadedPath, file);
+      import_fs7.default.renameSync(path2, (0, import_path8.join)(downloadedPath, "..", file));
     }
-    import_fs6.default.rmdirSync(downloadedPath);
+    import_fs7.default.rmdirSync(downloadedPath);
   }
-  const dbPath = (0, import_path7.join)(tmpPath, DB_EXPORT_FILE);
+  const dbPath = (0, import_path8.join)(tmpPath, DB_EXPORT_FILE);
   await exportDB(appId, {
     filter: defineFilter(config == null ? void 0 : config.excludeRows, config == null ? void 0 : config.excludeLogs),
     exportPath: dbPath
   });
+  if (config == null ? void 0 : config.encryptPassword) {
+    for (let file of import_fs7.default.readdirSync(tmpPath)) {
+      const path2 = (0, import_path8.join)(tmpPath, file);
+      await encryption_exports.encryptFile(
+        { dir: tmpPath, filename: file },
+        config.encryptPassword
+      );
+      import_fs7.default.rmSync(path2);
+    }
+  }
   if (config == null ? void 0 : config.tar) {
-    const tarPath = tarFilesToTmp(tmpPath, import_fs6.default.readdirSync(tmpPath));
-    import_fs6.default.rmSync(tmpPath, { recursive: true, force: true });
+    const tarPath = tarFilesToTmp(tmpPath, import_fs7.default.readdirSync(tmpPath));
+    import_fs7.default.rmSync(tmpPath, { recursive: true, force: true });
     return tarPath;
   } else {
     return tmpPath;
   }
 }
-async function streamExportApp(appId, excludeRows) {
+async function streamExportApp({
+  appId,
+  excludeRows,
+  encryptPassword
+}) {
   const tmpPath = await exportApp(appId, {
     excludeRows,
     excludeLogs: true,
-    tar: true
+    tar: true,
+    encryptPassword
   });
   return streamFile(tmpPath);
 }
@@ -18706,8 +18848,8 @@ __export(imports_exports, {
   untarFile: () => untarFile,
   updateAttachmentColumns: () => updateAttachmentColumns
 });
-var import_path8 = require("path");
-var import_fs7 = __toESM(require("fs"));
+var import_path9 = require("path");
+var import_fs8 = __toESM(require("fs"));
 init_src();
 var uuid4 = require("uuid/v4");
 var tar4 = require("tar");
@@ -18774,16 +18916,16 @@ async function getTemplateStream(template) {
     throw new Error("Cannot import a non-text based file.");
   }
   if (template.file) {
-    return import_fs7.default.createReadStream(template.file.path);
+    return import_fs8.default.createReadStream(template.file.path);
   } else if (template.key) {
     const [type, name2] = template.key.split("/");
     const tmpPath = await downloadTemplate(type, name2);
-    return import_fs7.default.createReadStream((0, import_path8.join)(tmpPath, name2, "db", "dump.txt"));
+    return import_fs8.default.createReadStream((0, import_path9.join)(tmpPath, name2, "db", "dump.txt"));
   }
 }
 function untarFile(file) {
-  const tmpPath = (0, import_path8.join)(budibaseTempDir2(), uuid4());
-  import_fs7.default.mkdirSync(tmpPath);
+  const tmpPath = (0, import_path9.join)(budibaseTempDir2(), uuid4());
+  import_fs8.default.mkdirSync(tmpPath);
   tar4.extract({
     sync: true,
     cwd: tmpPath,
@@ -18791,31 +18933,49 @@ function untarFile(file) {
   });
   return tmpPath;
 }
+async function decryptFiles(path2, password) {
+  try {
+    for (let file of import_fs8.default.readdirSync(path2)) {
+      const inputPath = (0, import_path9.join)(path2, file);
+      const outputPath = inputPath.replace(/\.enc$/, "");
+      await encryption_exports.decryptFile(inputPath, outputPath, password);
+      import_fs8.default.rmSync(inputPath);
+    }
+  } catch (err) {
+    if (err.message === "incorrect header check") {
+      throw new Error("File cannot be imported");
+    }
+    throw err;
+  }
+}
 function getGlobalDBFile(tmpPath) {
-  return import_fs7.default.readFileSync((0, import_path8.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
+  return import_fs8.default.readFileSync((0, import_path9.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
 }
 function getListOfAppsInMulti(tmpPath) {
-  return import_fs7.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
+  return import_fs8.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
 }
 async function importApp(appId, db2, template) {
   var _a, _b;
   let prodAppId = db_exports.getProdAppID(appId);
   let dbStream;
   const isTar = template.file && ((_b = (_a = template == null ? void 0 : template.file) == null ? void 0 : _a.type) == null ? void 0 : _b.endsWith("gzip"));
-  const isDirectory = template.file && import_fs7.default.lstatSync(template.file.path).isDirectory();
+  const isDirectory = template.file && import_fs8.default.lstatSync(template.file.path).isDirectory();
   if (template.file && (isTar || isDirectory)) {
     const tmpPath = isTar ? untarFile(template.file) : template.file.path;
-    const contents = import_fs7.default.readdirSync(tmpPath);
+    if (isTar && template.file.password) {
+      await decryptFiles(tmpPath, template.file.password);
+    }
+    const contents = import_fs8.default.readdirSync(tmpPath);
     if (contents.length) {
       let promises = [];
       let excludedFiles = [GLOBAL_DB_EXPORT_FILE, DB_EXPORT_FILE];
       for (let filename of contents) {
-        const path2 = (0, import_path8.join)(tmpPath, filename);
+        const path2 = (0, import_path9.join)(tmpPath, filename);
         if (excludedFiles.includes(filename)) {
           continue;
         }
-        filename = (0, import_path8.join)(prodAppId, filename);
-        if (import_fs7.default.lstatSync(path2).isDirectory()) {
+        filename = (0, import_path9.join)(prodAppId, filename);
+        if (import_fs8.default.lstatSync(path2).isDirectory()) {
           promises.push(
             objectStore_exports2.uploadDirectory(ObjectStoreBuckets2.APPS, path2, filename)
           );
@@ -18831,7 +18991,7 @@ async function importApp(appId, db2, template) {
       }
       await Promise.all(promises);
     }
-    dbStream = import_fs7.default.createReadStream((0, import_path8.join)(tmpPath, DB_EXPORT_FILE));
+    dbStream = import_fs8.default.createReadStream((0, import_path9.join)(tmpPath, DB_EXPORT_FILE));
   } else {
     dbStream = await getTemplateStream(template);
   }
@@ -19950,17 +20110,17 @@ __export(version_exports, {
   getLicenseVersion: () => getLicenseVersion,
   getProVersion: () => getProVersion
 });
-var import_fs8 = __toESM(require("fs"));
-var import_path9 = __toESM(require("path"));
+var import_fs9 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
 var getLicenseVersion = () => {
   if (environment_default2.isDev()) {
     const DEV_VER_FILENAME = "dev-version.txt";
-    const verFile = import_path9.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
-    if (import_fs8.default.existsSync(verFile)) {
-      return import_fs8.default.readFileSync(verFile, "utf8");
+    const verFile = import_path10.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
+    if (import_fs9.default.existsSync(verFile)) {
+      return import_fs9.default.readFileSync(verFile, "utf8");
     } else {
       const devVer = utils_exports2.newid();
-      import_fs8.default.writeFileSync(verFile, devVer);
+      import_fs9.default.writeFileSync(verFile, devVer);
       return devVer;
     }
   } else {
@@ -20319,16 +20479,16 @@ __export(offline_exports, {
   getOfflineLicense: () => getOfflineLicense,
   writeOfflineLicenseToDisk: () => writeOfflineLicenseToDisk
 });
-var import_fs9 = __toESM(require("fs"));
-var import_path10 = require("path");
+var import_fs10 = __toESM(require("fs"));
+var import_path11 = require("path");
 var import_os2 = require("os");
 var import_jsonwebtoken = __toESM(require("jsonwebtoken"));
 var SUB_DIRECTORY = environment_default2.isTest() ? ".budibase-test" : ".budibase";
-var DIRECTORY = (0, import_path10.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
+var DIRECTORY = (0, import_path11.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
 var OFFLINE_LICENSE_FILE = "offline_license.txt";
-var LICENSE_FILE_PATH = (0, import_path10.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
-if (!import_fs9.default.existsSync(DIRECTORY)) {
-  import_fs9.default.mkdirSync(DIRECTORY);
+var LICENSE_FILE_PATH = (0, import_path11.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
+if (!import_fs10.default.existsSync(DIRECTORY)) {
+  import_fs10.default.mkdirSync(DIRECTORY);
 }
 var PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvz3jePLCFBXZ19c8Dpkv\nXtSgOhKFOcvQdo/LV0KJRUzQWDPWuO4ILtBtnqhjtIzZH4CH0qCYBet5L6Qr4CM1\nl2HXiAD1Q2rlHNW9wDaYyKb1F5f+v4RyqCAyzlkwRdksmkLeECTboojNnmRCrE3C\n8suunQP5bEScqEY2kclqzSf8e6xqMzPUg3mL/pNa1iEv7TuLbU9nJfgR36l0WmZY\n94fWnSaT8OSXSqcxsaByf06gfS3HAoTJNc7eqz1Hf9fUORQGPUAnFK8cT3SfdA36\nd/o3ZWE1TTj1zYwlCLN5qRKr3hU8nC3xEYNEbkB9SfTRaOq9Q7P8WmfLkoCPm3pR\nmwIDAQAB\n-----END PUBLIC KEY-----\n";
 function getOfflineLicense() {
@@ -20339,16 +20499,16 @@ function getOfflineLicense() {
   }
 }
 function getOfflineLicenseFromDisk() {
-  if (import_fs9.default.existsSync(LICENSE_FILE_PATH)) {
-    const token = import_fs9.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
+  if (import_fs10.default.existsSync(LICENSE_FILE_PATH)) {
+    const token = import_fs10.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
     return import_jsonwebtoken.default.verify(token, PUBLIC_KEY, { algorithms: ["RS256"] });
   }
 }
 function writeOfflineLicenseToDisk(signedLicense) {
-  import_fs9.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
+  import_fs10.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
 }
 function deleteOfflineLicense() {
-  import_fs9.default.rmSync(LICENSE_FILE_PATH, { force: true });
+  import_fs10.default.rmSync(LICENSE_FILE_PATH, { force: true });
 }
 
 // ../pro/packages/pro/src/sdk/licensing/licenses/licenses.ts
@@ -21553,10 +21713,10 @@ __export(plugins_exports, {
 init_src();
 
 // ../pro/packages/pro/src/utilities/fileSystem.ts
-var import_fs10 = __toESM(require("fs"));
-var import_path11 = require("path");
+var import_fs11 = __toESM(require("fs"));
+var import_path12 = require("path");
 function loadJSFile(directory2, name2) {
-  return import_fs10.default.readFileSync((0, import_path11.join)(directory2, name2), "utf8");
+  return import_fs11.default.readFileSync((0, import_path12.join)(directory2, name2), "utf8");
 }
 
 // ../pro/packages/pro/src/sdk/plugins/index.ts
@@ -22193,7 +22353,7 @@ __export(processing_exports, {
   init: () => init12
 });
 init_src();
-var import_fs11 = __toESM(require("fs"));
+var import_fs12 = __toESM(require("fs"));
 async function init12(opts) {
   await getBackupQueue().process(async (job) => {
     const data = job.data;
@@ -22261,8 +22421,8 @@ async function runBackup(trigger, tenantId, appId, opts) {
       }
     });
     await updateMetadata("complete" /* COMPLETE */, { filename, contents });
-    if (import_fs11.default.existsSync(tarPath)) {
-      import_fs11.default.rmSync(tarPath);
+    if (import_fs12.default.existsSync(tarPath)) {
+      import_fs12.default.rmSync(tarPath);
     }
   } catch (err) {
     logging_exports.logAlert("App backup error", err);
@@ -22715,7 +22875,7 @@ router3.post(
 
 // ../pro/packages/pro/src/api/controllers/apps/backups.ts
 init_src();
-var import_fs12 = __toESM(require("fs"));
+var import_fs13 = __toESM(require("fs"));
 async function checkAppID(ctx, appId) {
   if (!await utils_exports5.appExists(appId)) {
     ctx.throw(400, `Provided app ID: ${appId} - is invalid.`);
@@ -22801,7 +22961,7 @@ async function downloadBackup(ctx) {
   const backupId = ctx.params.backupId;
   const { metadata: metadata2, path: path2 } = await backups_default2.downloadAppBackup(backupId);
   ctx.attachment(`backup-${metadata2.timestamp}.tar.gz`);
-  ctx.body = import_fs12.default.createReadStream(path2);
+  ctx.body = import_fs13.default.createReadStream(path2);
 }
 
 // ../pro/packages/pro/src/api/routes/apps/backups.ts